Supabase can use anonymized and aggregated data derived from your data and usage to improve and analyze its services, and this derived data is treated as Supabase's own intellectual property.
This analysis describes what Supabase's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Even though Supabase does not claim ownership of your raw customer data, it retains rights to insights and analytics derived from that data, which is a common but material practice in cloud service agreements that customers should factor into their own privacy disclosures.
Interpretive note: The adequacy of anonymization is not defined in the agreement; whether derived data meets GDPR or CCPA deidentification standards depends on implementation details not disclosed in this document.
The relocation of Supabase's legal entity from Delaware to Singapore may affect which jurisdiction's courts and laws apply to disputes, potentially impacting your ability to pursue claims in US courts and changing which consumer protection laws govern your relationship. The requirement to explicitly click 'I Accept' rather than accepting through sign-up or service use clarifies consent but does not substantively change the agreement's terms. The new section on AI-powered tools discloses that Supabase may use AI chatbots for customer support; review that section to understand how such tools may process your inquiries.
View change record →Data about how you and your users interact with Supabase's platform can be aggregated and used by Supabase indefinitely as its own intellectual property, even after your subscription ends. Customers with strict data minimization obligations under GDPR or sector-specific regulations should assess whether this derivation is disclosed in their own privacy notices.
How other platforms handle this
we may share data between our affiliates for the safety and security of our users and may take necessary actions if we believe you have violated these Terms, including banning you from our Services and/or our affiliates' services...
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
Each payment processor uses and processes your complete payment information in accordance with its applicable privacy policy (Stripe and PayPal).
""Aggregated Data" means data and information related to or derived from Customer Data or Customer's use of the Services that is used by Supabase in an aggregate and anonymized manner, including to compile statistical and performance information related to the Services. [...] "Supabase IP" means the Services, the Documentation, and any and all intellectual property provided to Customer or any Authorized User in connection with the foregoing. For the avoidance of doubt, Supabase IP includes Aggregated Data and any information, data, or other content derived from Supabase's provision of the Services but does not include Customer Data.Excerpt from Supabase's Terms of Service
REGULATORY LANDSCAPE: The Aggregated Data provision implicates GDPR Article 5 (data minimization and purpose limitation) and Recital 26 (anonymization standards), as well as CCPA definitions of deidentified data.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Even though Supabase does not claim ownership of your raw customer data, it retains rights to insights and analytics derived from that data, which is a common but material practice in cloud service agreements that customers should factor into their own privacy disclosures.
Data about how you and your users interact with Supabase's platform can be aggregated and used by Supabase indefinitely as its own intellectual property, even after your subscription ends. Customers with strict data minimization obligations under GDPR or sector-specific regulations should assess whether this derivation is disclosed in their own privacy notices.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Supabase.